Date: September 27, 2026
Author: Threat Research & Intelligence Team, Digital Spying
Category: Malware Analysis / Endpoint Security / Kernel Exploitation
Tags: Lunex, Psychedelic Stealer, BYOVD, AMD Driver, EDR Evasion, Native Messaging Host, Infostealer
Executive Summary
The commoditization of advanced nation-state evasion techniques has reached a dangerous milestone. On September 26–27, 2026, cybersecurity threat researchers at Ontinue and The Hacker News published technical findings detailing Lunex (also marketed across dark web forums as Psychedelic Stealer)—a rapidly expanding Malware-as-a-Service (MaaS) platform targeting enterprise and personal workstations globally.
Delivered through aggressive ClickFix social engineering lures disguised as legitimate Cloudflare security checks, Lunex features a lethal technical innovation: a Bring Your Own Vulnerable Driver (BYOVD) attack that drops a legitimately signed but vulnerable AMD Radeon graphics driver. By abusing the driver's kernel-mode read/write primitives, Lunex systematically unregisters operating system kernel callbacks, blinding Microsoft Defender, CrowdStrike Falcon, and SentinelOne without triggering driver-signature warnings.
Once security monitoring is silenced, Lunex deploys a stealthy persistence mechanism utilizing a PowerShell-based Native Messaging Host embedded directly within Chromium browsers, systematically exfiltrating stored credentials, session cookies, and cryptocurrency wallets from seven major browsers.
Technical Deep-Dive: Deconstructing the Lunex Attack Chain
To understand how Lunex neutralizes enterprise endpoint defenses, we dissect its delivery pipeline, kernel manipulation routines, and browser-level persistence.+-----------------------------------------------------------------------------------+
| LUNEX STEALER INFECTION & BYOVD PIPELINE |
|---|
Victim User (Web Browser) Windows Kernel Domain (Ring 0) Chromium Browsers & C2 Server
| | |
| 1. Encounters ClickFix fake Cloudflare CAPTCHA: | |
| "Press Win+R, paste verification command" | |
|------------------------------------------------------->| |
| 2. Executes PowerShell stager -> Downloads LunexLoader | |
| | |
| 3. Drops legitimately signed, vulnerable AMD Driver: | |
| `amd_driver.sys` into `\SystemRoot\System32\` | |
|------------------------------------------------------->| |
| | 4. Exploits Driver IOCTL Primitives: |
| | - Reads kernel memory addresses |
| | - Unregisters `ObRegisterCallbacks` |
| | - Strips Process Notify Routines |
| | |
| | 5. EDR & Windows Defender BLINDED! |
| | Security agents cannot inspect processes|
| |<--------------------------------------------|
| |
| 6. Installs Native Messaging Host Persistence: |
| Registers manifest in `HKCU\Software\Google\Chrome\NativeMessagingHosts\` |
|----------------------------------------------------------------------------------------------------->|
| |
| 7. Siphons Master Keys via DPAPI: |
| Dumps Passwords, Cookies, Crypto Wallets from Chrome, Edge, Brave, Opera, Vivaldi |
|----------------------------------------------------------------------------------------------------->|
| 8. Exfiltrates stolen credentials to attacker C2! |
|<=====================================================================================================|
1. Delivery via ClickFix Social Engineering
Rather than relying on exploit kits or malicious macro attachments, Lunex utilizes the ClickFix technique:
* Victims visiting compromised websites encounter a high-fidelity overlay mimicking a Cloudflare or Google reCAPTCHA verification challenge.
* The prompt falsely claims: "To verify you are human, press Windows Key + R, then press Ctrl+V and Enter."
* The clipboard is pre-loaded with an obfuscated base64 PowerShell command that immediately downloads and executes LunexLoader, seamlessly bypassing User Account Control (UAC).
2. The Kernel-Mode BYOVD Assault: Blinding EDR
Endpoint Detection and Response (EDR) agents rely on Windows kernel notification callbacks to monitor suspicious behaviors:
* PsSetCreateProcessNotifyRoutineEx: Alerts EDRs when a new process is spawned.
* ObRegisterCallbacks: Prevents malicious processes from opening high-privilege handles to sensitive security binaries or lsass.exe.
Because modern 64-bit Windows enforces Driver Signature Enforcement (DSE), malware cannot load unsigned kernel rootkits directly. Lunex solves this via BYOVD:
1. Dropping Signed AMD Driver: LunexLoader drops a verified, Microsoft-signed but historically vulnerable AMD Radeon graphics driver (amd_driver.sys).
2. Abusing IOCTL Primitives: The malware sends crafted I/O Control (IOCTL) codes to the driver’s exposed device object, obtaining unrestricted arbitrary read and write access to physical kernel memory.
3. Zeroing Callback Arrays: Lunex locates the kernel's PspCreateProcessNotifyRoutine and ObRegisterCallbacks pointer tables, systematically zeroing out the function pointers registered by installed antivirus and EDR drivers.
4. The Result: The EDR agents continue running in user-space, giving admins the false impression that protection is active. In reality, the security software is completely blinded and receives zero telemetry from the operating system.
3. Covert Persistence via Native Messaging Hosts
To avoid detection from standard persistence scanners that inspect the Windows Startup folder or Run registry keys, Lunex uses an innovative browser-native technique:
* In Chromium-based browsers, the Native Messaging API allows web extensions to communicate with an installed local executable via a JSON manifest file.
* Lunex registers a rogue Native Messaging Host in the Windows registry:
HKCU\Software\Google\Chrome\NativeMessagingHosts\com.system.updater
* The manifest points to an obfuscated PowerShell script. Every time the user launches Chrome, Edge, Brave, or Opera, the browser automatically launches the persistent malware agent in the background.
4. Credential & Cryptocurrency Wallet Harvesting
With endpoint defenses suppressed, Lunex launches its data-theft modules:
* Chromium Decryption: Extracts the encrypted DPAPI master keys from Local State, decrypting stored usernames, passwords, credit cards, and session cookies across seven Chromium browsers.
* Wallet Draining: Searches browser extension directories for cryptocurrency wallets (MetaMask, Phantom, TronLink, Coinbase Wallet, Exodus), extracting seed phrases and private keys before transmitting them via encrypted HTTPS to the attacker's C2.
Strategic Threat Impact: The Escalation of Commodity Malware
The arrival of Lunex marks a critical inflection point in the cyber threat landscape:
* Democratization of Kernel Attacks: Techniques previously exclusive to nation-state APTs (such as Lazarus or BlackCat) are now bundled into low-cost commodity stealer frameworks sold to low-skilled cybercriminals for as little as $150 per month.
* The Failure of Static Driver Blocklists: Despite Microsoft maintaining a Vulnerable Driver Blocklist, threat actors continuously unearth newly disclosed, signed OEM hardware drivers (AMD, ASUS, Gigabyte) that have not yet been blacklisted across standard enterprise images.
Defensive Hardening & Mitigation Blueprint
Security operations teams and system administrators must deploy multi-layered safeguards against BYOVD attacks and browser-level persistence:
1. Enable Hypervisor-Protected Code Integrity (HVCI)
* Enable Memory Integrity / HVCI in Windows Security:
Check if Hypervisor-Enforced Code Integrity is running
Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\Microsoft\Windows\DeviceGuard | Select-Object SecurityServicesRunning
HVCI runs kernel code inside an isolated virtualized container, preventing vulnerable drivers from overwriting kernel callback pointers.
* Enforce the Microsoft Recommended Driver Block Rules via Windows Defender Application Control (WDAC).
2. Audit and Restrict Browser Native Messaging Hosts
Regularly scan user registry hives for unauthorized Native Messaging Hosts:# Search for suspicious Native Messaging Hosts in user registry
Get-ChildItem -Path "HKCU:\Software\Google\Chrome\NativeMessagingHosts"
Get-ChildItem -Path "HKCU:\Software\Microsoft\Edge\NativeMessagingHosts"
Enterprise environments should enforce Group Policy Objects (GPOs) that restrict Native Messaging Hosts strictly to an approved enterprise whitelist:Computer Configuration > Administrative Templates > Google Chrome > Native Messaging > Native Messaging host allowlist
3. Block Script Execution from Untrusted Dialogs
* Enable Attack Surface Reduction (ASR) rules in Microsoft Defender:
* Block process creation from PSExec and WMI commands.
* Block executable files from running unless they meet a prevalence, age, or trusted list criterion.
* Educate workforce personnel against ClickFix social engineering lures that instruct users to paste commands into the Windows Run (Win+R) prompt.
For technical threat intelligence advisories, malware reverse-engineering breakdowns, and enterprise defense guides, follow Digital Spying.